Immutable File Protection
Relevant source files
The following files were used as context for generating this wiki page:
Immutable File Protection is a security mechanism implemented within the DNS Hardening Parrot project to prevent unauthorized modifications to critical system network configurations. By leveraging the Linux chattr utility to set the +i (immutable) attribute on /etc/resolv.conf, the system ensures that dynamic services such as NetworkManager, Portmaster, or even the root user cannot alter the DNS resolver settings without explicitly removing the protection flag first.
The primary scope of this feature is to maintain a static, hardened DNS configuration that points to a local Unbound resolver while providing a layered defense against DNS hijacking, Man-in-the-Middle (MITM) attacks, and configuration drift caused by automated system utilities. Sources: README.md:25-35, scripts/dns_harden.sh:37-41, CHANGELOG.md:8-10
Implementation Architecture
The protection system operates through a lifecycle of hardening, monitoring, and emergency restoration. It utilizes kernel-level file attributes to enforce write-protection and script-based automation to manage these attributes during legitimate configuration updates.
Hardening Logic
The hardening process involves removing existing symlinks (often managed by systemd-resolved or NetworkManager), creating a static /etc/resolv.conf, and applying the immutable bit.
The implementation ensures that NetworkManager is explicitly instructed not to manage DNS via a configuration file in /etc/NetworkManager/conf.d/dns-hardening.conf to prevent service conflicts. Sources: scripts/dns_harden.sh:25-50, TEST_RESULTS.md:24-34
Monitoring and Integrity Alerts
To ensure the immutable protection remains active, the project includes specialized monitoring scripts that verify the file attributes and contents at regular intervals.
State Detection and Alerting
dns_monitor.sh: Tracks the state of the immutable flag and logs transitions between "HARDENED" and "COMPROMISED" states to/var/run/dns_hardening.state. Sources: scripts/dns_monitor.sh:9-30dns_alert.sh: Performs aggressive checks (typically via cron) and issues immediate alerts if the+iflag is missing or if the local resolver (127.0.0.1) is no longer the primary nameserver. Sources: scripts/dns_alert.sh:19-32
| Component | Check Target | Failure Condition | Result |
|---|---|---|---|
lsattr | /etc/resolv.conf | ----i--------- missing | Status: COMPROMISED |
grep | /etc/resolv.conf | nameserver 127.0.0.1 not first | Status: COMPROMISED |
systemctl | unbound.service | Service not active | Status: INACTIVE |
Sources: scripts/dns_status.sh:15-45, MONITORING.md:21-45
Emergency Restoration and Management
The dns_restore.sh script provides a mechanism to bypass immutable protection during system failures. It programmatically removes the immutable bit to allow the restoration of standard public resolvers.
Sources: scripts/dns_restore.sh:53-75, README.md:46-55
Key Protection Commands
| Action | Command | Scope |
|---|---|---|
| Apply Protection | sudo chattr +i /etc/resolv.conf | Prevents all modifications |
| Remove Protection | sudo chattr -i /etc/resolv.conf | Allows temporary changes |
| Verify Protection | lsattr /etc/resolv.conf | Displays active attributes |
| Hardened Config | cat /etc/NetworkManager/conf.d/dns-hardening.conf | Disables NM DNS management |
Sources: scripts/dns_harden.sh:41-55, README_SHORT.md:46-52
Security Benefits and Threat Mitigation
Immutable File Protection specifically addresses several attack vectors and system behaviors that typically degrade DNS security posture:
- Unauthorized Modification: Even the
rootuser cannot modify the file untilchattr -iis executed, preventing accidental changes by system updates or malicious scripts. Sources: TEST_RESULTS.md:40-42 - Portmaster/NetworkManager Resistance: Prevents third-party network tools from overwriting local resolver settings with their own DNS values. Sources: README_SHORT.md:33-40
- Configuration Drift: Ensures that the system remains locked to the local Unbound resolver and its DNS over TLS (DoT) upstream connections. Sources: README.md:12-20
Conclusion
The Immutable File Protection system is the cornerstone of the DNS Hardening Parrot project. By combining kernel-level file locking with active monitoring and automated restoration, it creates a "set-and-forget" security layer that keeps the system in the top 1-2% of global DNS security postures. This approach ensures that privacy-enhancing configurations like DNS over TLS and DNSSEC validation remain enforced regardless of system-level network management events. Sources: README.md:165-175, TEST_RESULTS.md:65-70